Protocol history

WireGuard: a VPN protocol small enough to actually audit.

Most VPN protocols grew by accretion over decades. WireGuard was designed from scratch by one person who wanted something simple enough to read in an afternoon — and it ended up faster than almost everything before it.

Where WireGuard came from

WireGuard was created by security researcher Jason A. Donenfeld, who started the project around 2015–2016 out of frustration with the two dominant VPN options at the time: IPsec, which he found bloated and difficult to configure correctly, and OpenVPN, which was flexible but ran in userspace and carried the performance overhead that comes with it. He set out to write something different — a VPN that could live inside the Linux kernel itself, with a codebase small enough for a single engineer to read and verify.

The result, first published in 2016, was startling in its size: roughly 4,000 lines of code, compared to hundreds of thousands in OpenVPN or the IPsec stack. Linus Torvalds, not known for handing out compliments lightly, called it "a work of art" compared to the alternatives. It was merged into the mainline Linux kernel in 2020.

How it actually works

WireGuard doesn't negotiate ciphers the way older protocols do. Instead of offering a menu of algorithms that both ends have to agree on — a process that's historically been a source of downgrade attacks — it hard-codes one modern, opinionated set: Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, and BLAKE2s for hashing. If you want different cryptography, you use a different version of WireGuard; the protocol itself doesn't negotiate.

Its handshake is built on the Noise Protocol Framework, a modern toolkit for building secure handshakes that predates and heavily influenced protocols like Signal's. The handshake completes in a single round trip, keys rotate automatically every two minutes, and — notably — WireGuard has no concept of connection state the way TCP-based VPNs do. Interfaces simply associate a public key with an IP address; if your network changes (Wi-Fi to LTE, for instance), the tunnel just keeps working without a visible reconnect.

The tradeoff to know about

WireGuard's speed and simplicity come from being opinionated about what it is: a fast, minimal tunnel. Out of the box it has a very recognizable packet structure, which makes it easy for deep packet inspection to identify — this is why circumvention-focused deployments typically wrap WireGuard traffic in an obfuscation layer rather than exposing it directly.

WireGuard vs. OpenVPN

PropertyOpenVPNWireGuard
Codebase size~600,000 lines~4,000 lines
Runs inUserspaceKernel (or fast userspace)
Cipher negotiationConfigurable (TLS-based)Fixed, modern suite
Handshake speedMultiple round tripsSingle round trip
Default stealthModerateLow — needs obfuscation wrapper

Where you'll encounter it

WireGuard is now the underlying engine for a large share of modern VPN services, including well-known consumer products that rebrand it (NordVPN's "NordLynx" and Mullvad's default configuration are both built on WireGuard). Its speed advantage is largest on mobile and lower-power devices, where the overhead of older userspace protocols is most noticeable.

MiTiVPN's multi-hop routing core is WireGuard-based for exactly this reason — but it's never exposed directly. Every WireGuard tunnel is wrapped in the same obfuscation layer used for VLESS traffic, so the speed advantage doesn't come at the cost of a detectable fingerprint.

← Back to protocol comparison MiTiVPN home